A network security event report generation method and device based on a dynamic resolution community discovery algorithm, equipment and medium

Abstract

The application discloses a network security event report generation method and device based on a dynamic resolution community discovery algorithm, equipment and a medium, and relates to the field of network security. The method comprises the following steps: extracting target information in original network security alarm data as nodes, and constructing a time sequence relationship graph based on the nodes and the directed edges between the nodes; enumerating a plurality of resolutions in a preset resolution interval, performing a preset community discovery algorithm on the time sequence relationship graph according to the plurality of resolutions to obtain corresponding community division results, and determining an optimal community division result based on the normalized mutual information between the community division results; subdividing or merging the sub-communities in the optimal community division result to obtain a target community division result; identifying a core attack node in the target community division result; performing a depth-first search on the target community division result starting from the core attack node to extract a path set having a causal association with the core attack node, and generating a security event report based on the path set.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and in particular to a method, apparatus, device, and medium for generating cybersecurity incident reports based on a dynamic resolution community discovery algorithm. Background Technology

[0002] During network traffic detection and security operations, massive amounts of alarm logs are continuously generated. Traditional security operation models heavily rely on manual experience or static rule matching for alarm analysis, which is not only inefficient but also prone to missed diagnoses, false positives, and incomplete reconstruction of the attack process. To address these issues, existing technologies have developed multi-step attack tracing schemes based on community discovery. These schemes construct alarm event relationship graphs, use supervised learning and logistic regression to weight nodes, and further improve the Louvain community discovery algorithm to achieve attack community segmentation and tracing. However, this scheme still has significant limitations: First, it relies on manually labeled samples to train weights, making it difficult to obtain sufficient high-quality labeled data in actual operation. This results in weight allocation being easily affected by sample bias and weak generalization ability when facing unknown or non-specific attack scenarios. Second, the weight learning process lacks interpretability and cannot intuitively reveal the impact of weight changes on community partitioning results, reducing the transparency of tracing results. Third, it is sensitive to noisy data and abnormal nodes, which can easily lead to fragmentation of community partitioning and decreased stability. Fourth, it only outputs subgraphs of community partitioning and lacks analysis of semantic relationships within communities and attack chain reconstruction mechanisms. It still requires manual interpretation of key attack paths and causal logic in the subgraphs, increasing the workload of operation personnel and reducing the efficiency and accuracy of tracing. Summary of the Invention

[0003] In view of this, the purpose of this application is to provide a method, apparatus, device, and medium for generating network security incident reports based on a dynamic resolution community detection algorithm. This algorithm enables automated attack chain mining and tracing of massive amounts of alarm data, significantly improving the accuracy, interpretability, and operational efficiency of alarm analysis. The specific solution is as follows:

[0004] Firstly, this application provides a method for generating network security incident reports based on a dynamic resolution community detection algorithm, including:

[0005] Target information is extracted from the original network security alarm data as nodes. Directed edges are established between nodes according to the chronological order and logical relationship of events. A temporal relationship graph is constructed based on the nodes and directed edges. The target information includes alarm events, attack sources, and affected assets. The directed edges include a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected assets.

[0006] Multiple resolutions are enumerated within a preset resolution range. A preset community detection algorithm is executed on the temporal relationship graph according to different resolutions to obtain corresponding community partitioning results. The normalized mutual information between each community partitioning result is determined. Based on the normalized mutual information between each community partitioning result, the average stability index corresponding to each community partitioning result is determined. The community partitioning result with the highest average stability index is taken as the optimal community partitioning result. The preset community detection algorithm is used to partition semantically related nodes in the temporal relationship graph into the same community. The average stability index is the average value of the normalized mutual information between any community partitioning result and all other community partitioning results corresponding to the resolution range.

[0007] The corresponding local resolution is reallocated to each sub-community in the optimal community division result. The preset community discovery algorithm is executed on the corresponding sub-community and adjacent sub-regions according to the local resolution to achieve the subdivision or merging of the sub-communities in the optimal community division result, so as to obtain the final target community division result.

[0008] Using a pre-defined large language model, the core attack nodes in the target community segmentation results are identified based on node attributes, and confidence is assigned to the core attack nodes; the core attack nodes are alarm event nodes that meet the pre-defined critical stage criteria of the attack chain.

[0009] Based on the confidence level, and starting from the core attack node, a depth-first search is performed on the target community segmentation results to extract a set of paths that are causally related to the core attack node. A security event report corresponding to the original network security alarm data is generated based on the path set using a preset large language model.

[0010] Optionally, the method for generating network security incident reports based on the dynamic resolution community detection algorithm further includes:

[0011] When new raw network security alarm data is detected, the target information in the new raw network security alarm data is extracted as a new node;

[0012] Based on the chronological order and logical relationship of events, as well as the existing temporal relationship graph, directed edges are generated between the newly added nodes and between the newly added nodes and nodes in the temporal relationship graph.

[0013] The newly added nodes and the generated directed edges are added to the temporal relationship graph.

[0014] Optionally, the step of reallocating the corresponding local resolution for each sub-community in the optimal community partitioning result includes:

[0015] Based on the objective formula, the corresponding local resolution is reallocated to each sub-community in the optimal community partitioning result; the objective formula is:

[0016] ;

[0017] For the local resolution allocated to sub-community i, This is an adjustment factor obtained based on the deviation between the internal density of sub-community i and the global average community density. Let be the number of internal nodes of sub-community i, that is, the total number of directed edges established between all nodes in sub-community i. Let be the number of external nodes in sub-community i, that is, the total number of directed edges established between internal nodes and external nodes of sub-community i. It is a tiny constant. This is the time span factor for sub-community i, used to prevent communities that meet the preset high-density criteria from being over-splitting. The alarm time span of sub-community i is the difference between the earliest and latest alarm times among all alarm events in sub-community i.

[0018] in, The definition of is:

[0019] ;

[0020] For the internal density of sub-community i, The global average community density;

[0021] The definition of is:

[0022] ;

[0023] To suppress the scaling factor of the split, This is the preset minimum time span threshold.

[0024] Optionally, before identifying the core attack nodes in the target community segmentation results using a preset large language model based on node attributes, the method further includes:

[0025] Identify each group of target alarm nodes that meet the preset fusion conditions from the alarm relationship graph corresponding to the target community division results; the preset fusion conditions are that for any group of target alarm nodes, the target alarm nodes correspond to the same attack source or the same affected asset, are triggered within a preset time window, and the alarm rules triggered are the same.

[0026] Each group of target alarm nodes is merged to obtain a corresponding aggregate node; the attributes of the aggregate node include alarm trigger frequency, first alarm trigger timestamp, and last alarm trigger timestamp;

[0027] Redundant node attributes of each node in the alarm relationship graph after node merging are removed. The data structure of the alarm relationship graph after node attribute removal is converted into a preset index structure to obtain the target alarm relationship graph. The preset index structure includes a node table storing all nodes and an edge table storing all edges in the form of triples. The format of the triples is [source node index, target node index, relationship type].

[0028] Optionally, the step of using a preset large language model to identify core attack nodes in the target community partitioning results based on node attributes and assigning confidence scores to the core attack nodes includes:

[0029] Using a pre-defined large language model, the core attack nodes in the target alarm relationship graph are identified based on node attributes, and a confidence level is assigned to the core attack nodes; the confidence level represents the probability that the corresponding node is a core attack node.

[0030] Optionally, the step of performing a depth-first search on the target community segmentation result based on the confidence level and starting from the core attack node to extract a set of paths causally related to the core attack node includes:

[0031] Set an upper limit on the depth of the path search; the upper limit on the depth is used to limit the maximum level of the recursive search starting from the search starting point;

[0032] The core attack nodes are sorted in descending order of confidence. The core attack node with the highest confidence is selected as the current search starting point to perform a depth-first search on the target alarm relationship graph. The search of the current path is terminated when the upper limit of the depth is reached or the confidence of the subsequent nodes in the path is lower than a preset threshold, and the corresponding path set is obtained.

[0033] The next core attack node from the current search starting point is taken as the new current search starting point, and the process jumps to the step of performing a depth-first search on the target alarm relationship graph until the path set corresponding to each core attack node is obtained.

[0034] Optionally, generating the security event report corresponding to the original network security alarm data based on the path set includes:

[0035] The alarm events within the path set are divided into attack stages to obtain the division results. A causal attack chain between the attack source and the affected assets is constructed. The attack trend is predicted based on the temporal distribution and behavioral characteristics of the alarms to obtain the prediction results.

[0036] Based on the segmentation results, the causal attack chain, and the prediction results, security handling suggestions are generated, and based on the security handling suggestions, a security incident report corresponding to the original network security alarm data is generated.

[0037] Secondly, this application provides a network security incident report generation device based on a dynamic resolution community detection algorithm, comprising:

[0038] The information extraction module is used to extract target information from the original network security alarm data as nodes, establish directed edges between nodes according to the chronological order and logical relationship of events, and construct a temporal relationship graph based on the nodes and directed edges. The target information includes alarm events, attack sources, and affected assets. The directed edges include a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected assets.

[0039] The first node partitioning module is used to enumerate multiple resolutions within a preset resolution range, execute a preset community detection algorithm on the temporal relationship graph according to different resolutions, obtain corresponding community partitioning results, determine the normalized mutual information between each community partitioning result, determine the average stability index corresponding to each community partitioning result based on the normalized mutual information between each community partitioning result, and take the community partitioning result with the highest average stability index as the optimal community partitioning result; wherein, the preset community detection algorithm is used to partition semantically related nodes in the temporal relationship graph into the same community, and the average stability index is the average value of the normalized mutual information between any community partitioning result and all other community partitioning results corresponding to the resolution range;

[0040] The second node partitioning module is used to reallocate the corresponding local resolution to each sub-community in the optimal community partitioning result, and execute the preset community discovery algorithm on the corresponding sub-community and adjacent sub-regions according to the local resolution, so as to subdivide or merge the sub-communities in the optimal community partitioning result and obtain the final target community partitioning result.

[0041] The node identification module is used to identify the core attack nodes in the target community division results based on node attributes using a preset large language model and assign confidence to the core attack nodes; the core attack nodes are alarm event nodes that meet the preset attack chain key stage criteria.

[0042] The report generation module is used to perform a depth-first search on the target community segmentation results based on the confidence level and starting from the core attack node, to extract a set of paths that are causally related to the core attack node, and to generate a security event report corresponding to the original network security alarm data based on the set of paths using a preset large language model.

[0043] Thirdly, this application provides an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor is used to execute the computer program to implement the aforementioned method for generating network security incident reports based on a dynamic resolution community detection algorithm.

[0046] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned method for generating network security incident reports based on a dynamic resolution community detection algorithm.

[0047] In this application, target information is extracted from the original network security alarm data as nodes. Directed edges are established between nodes based on the chronological order and logical relationships of events. A temporal relationship graph is constructed based on the nodes and directed edges. The target information includes alarm events, attack sources, and affected assets. The directed edges include a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected assets. Multiple resolutions are enumerated within a preset resolution range. A preset community detection algorithm is executed on the temporal relationship graph according to different resolutions to obtain corresponding community partitioning results. The normalized mutual information between each community partitioning result is determined. Based on the normalized mutual information between each community partitioning result, the average stability index corresponding to each community partitioning result is determined. The community partitioning result with the highest average stability index is taken as the optimal community partitioning result. The preset community detection algorithm is used to identify semantically related elements in the temporal relationship graph. Related nodes are classified into the same community. The average stability index is the average of the normalized mutual information between any community classification result and all other community classification results corresponding to the resolution range. Local resolutions are reassigned to each sub-community in the optimal community classification result. Based on the local resolution, the preset community discovery algorithm is executed on the corresponding sub-communities and adjacent sub-regions to achieve subdivision or merging of the sub-communities in the optimal community classification result, resulting in the final target community classification result. A preset large language model is used to identify core attack nodes in the target community classification result based on node attributes and assign confidence to the core attack nodes. The core attack nodes are alarm event nodes that meet the preset attack chain key stage criteria. Based on the confidence and starting from the core attack nodes, a depth-first search is performed on the target community classification result to extract a set of paths causally related to the core attack nodes. A preset large language model is used to generate a security event report corresponding to the original network security alarm data based on the path set. As shown above, this application avoids the need for extensive manual annotation of node weights in traditional schemes by constructing a temporal relationship graph and performing multi-resolution enumeration and stability evaluation based on an unsupervised community detection algorithm. The temporal relationship graph automatically captures the temporal and logical relationships between alarm events, attack sources, and assets. The community partitioning process does not rely on specific labeled samples but adaptively identifies community structures through algorithms, thereby significantly improving adaptability and generalization ability to unknown or non-specific attack scenarios. Multi-resolution community detection and stability metrics are used to optimize transparency. Community partitioning is selected based on normalized mutual information and average stability metrics, which have clear statistical significance, enhancing the interpretability of the partitioning results.Furthermore, by identifying and assigning confidence scores to core attack nodes using a large language model, the role of key nodes in the attack chain is further revealed, making the entire tracing process more intuitive and traceable, and improving the credibility of the results. Multi-resolution community discovery and local resolution adjustment effectively mitigate sensitivity to noisy data and anomalous nodes. Multi-resolution enumeration allows the system to evaluate the stability of community partitioning at different granularities, and the average stability index helps select partitioning results with strong anti-interference capabilities. The local resolution adjustment step further subdivides or merges sub-communities, dynamically adapting to local changes in the data, thereby reducing the fragmentation of community partitioning and improving overall stability and robustness. A large language model and depth-first search are introduced to automate attack chain extraction and report generation. The large language model identifies core attack nodes based on node attributes and assigns confidence scores, while depth-first search extracts causal relationship paths from these nodes. Finally, the large language model generates a structured security event report. This process achieves automatic semantic analysis within communities and reconstruction of attack chains, significantly reducing the burden of manual interpretation and improving the efficiency and accuracy of tracing. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1 This application discloses a flowchart of a method for generating network security incident reports based on a dynamic resolution community detection algorithm.

[0050] Figure 2 This is a schematic diagram of a specific network security incident report generation method based on a dynamic resolution community detection algorithm disclosed in this application;

[0051] Figure 3 This is a schematic diagram of a network security incident report generation device based on a dynamic resolution community detection algorithm disclosed in this application;

[0052] Figure 4 This is a schematic diagram of the structure of an electronic device disclosed in this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] Currently, multi-step attack attribution schemes based on community discovery still suffer from problems such as weak generalization ability when facing unknown or non-specific attack scenarios, low transparency of attribution results, and low efficiency and accuracy. To address these issues, this application provides a network security incident report generation method based on a dynamic resolution community discovery algorithm. This algorithm enables automated attack chain mining and attribution of massive amounts of alarm data, significantly improving the accuracy, interpretability, and operational efficiency of alarm analysis.

[0055] See Figure 1 As shown in the figure, this application discloses a method for generating network security incident reports based on a dynamic resolution community detection algorithm, including:

[0056] Step S11: Extract target information from the original network security alarm data as nodes, establish directed edges between nodes according to the order of events and logical relationships, and construct a temporal relationship graph based on nodes and directed edges; the target information includes alarm events, attack sources and affected assets, and the directed edges include a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected assets.

[0057] In this embodiment, the original network security alarm data of the intrusion detection system is standardized and structured to extract target information, i.e. key element information, including alarm events, attack sources and affected assets as node entities. Based on the order of events and logical associations, a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected asset are established. A temporal relationship graph is constructed based on the nodes and directed edges.

[0058] Since intrusion detection systems continuously generate raw network security alert data, an incremental temporal relationship model can be constructed. This model's incremental temporal relationship graph construction mechanism builds a dynamic temporal relationship graph. Specifically, this can include: when new raw network security alert data is detected, extracting the target information from the new data as a new node; then, based on the chronological order and logical relationships of events, and the existing temporal relationship graph, generating directed edges between the new nodes and between the new nodes and nodes in the temporal relationship graph; finally, adding the new nodes and the generated directed edges to the temporal relationship graph.

[0059] Step S12: Enumerate multiple resolutions within a preset resolution range, and execute a preset community detection algorithm on the temporal relationship graph according to different resolutions to obtain corresponding community partitioning results. Determine the normalized mutual information between each community partitioning result, and determine the average stability index corresponding to each community partitioning result based on the normalized mutual information between each community partitioning result. The community partitioning result with the highest average stability index is taken as the optimal community partitioning result. The preset community detection algorithm is used to partition semantically related nodes in the temporal relationship graph into the same community, and the average stability index is the average value of the normalized mutual information between any community partitioning result and all other community partitioning results corresponding to the resolution range.

[0060] This embodiment uses an improved dynamic resolution Louvain community detection algorithm to adaptively partition a time-series relationship graph constructed from network security alert data, thereby identifying potential attack event sets. The core objective of this algorithm is to maximize network modularity to obtain the optimal community structure. The traditional Louvain community detection algorithm is defined as follows:

[0061] ;

[0062] in, Modularity is a core indicator used to measure the quality of community partitioning. Its value range is [-1, 1]. The closer the value is to 1, the tighter the internal connections and the sparser the external connections of the community, and the better the partitioning effect. For resolution parameters; This represents the total number of edges in the graph. Let be the elements of the adjacency matrix of the graph. If there is an edge or weight between node i and node j, then If the value is 1, then it is 0 if there is no edge or no weight. =0; , Let i and j be the degrees of node i and node j, respectively. Let Kronecker function be used.

[0063] Traditional Louvain algorithm with fixed resolution Values, but optimal values ​​vary across different subgraphs and stages. The difference lies in the dynamic resolution Louvain community partitioning used in this embodiment. This method enumerates resolutions within the resolution adjustment range and partitions communities using the traditional Louvain algorithm. Normalized Mutual Information (NMI) is used as the multi-scale fusion index, and the most stable community partitioning result is selected as the optimal community partitioning result.

[0064] The specific steps for the dynamic resolution Louvain community partitioning are as follows:

[0065] Get resolution The adjustment range is as follows:

[0066] ;

[0067] Used to control the coarsest granularity and prevent large communities from being over-splittered; This is used to control the finest granularity, ensuring that small communities can be identified.

[0068] Pick =0.6, =1.9, and enumerate multiple values ​​within this interval by step size. value.

[0069] For each Execute the Louvain algorithm to obtain the corresponding community partitioning result set:

[0070] ;

[0071] Due to different Different community partitioning results may occur. To improve the stability and generalization ability of the algorithm at multiple scales, it is possible to... Multi-scale fusion is performed within the adjustment interval. Through cross-scale structural consistency comparison and aggregation analysis, community structures that are stable at different resolutions are extracted to obtain the most representative attack event classification.

[0072] In the multi-scale fusion stage, normalized mutual information is introduced as an aggregation metric to measure the consistency between different community divisions, defined as follows:

[0073] ;

[0074] in, This represents the mutual information between the two communities. The entropy of the community division is represented; the NMI value ranges from [0,1], and the closer the value is to 1, the more consistent the division is.

[0075] For resolution Calculate the NMI for all community division results within the adjustment interval, and obtain the average stability index corresponding to each community division result. The definition is as follows:

[0076] ;

[0077] Select Largest community division results The optimal community partitioning result is used to ensure the robustness and multi-scale consistency of the partitioning result.

[0078] Step S13: Reassign the corresponding local resolution to each sub-community in the optimal community division result, and execute the preset community discovery algorithm on the corresponding sub-community and adjacent sub-regions according to the local resolution, so as to subdivide or merge the sub-communities in the optimal community division result and obtain the final target community division result.

[0079] The optimal community partitioning result obtained through global Louvain partitioning can reveal the overall distribution of attack activities at a macro level, but the following problems may occur at the detailed level: high-density core attack chains and low-density peripheral alerts are merged into the same community, and sparse low-density communities are mistakenly split into multiple small communities.

[0080] To address the aforementioned issues, a local dynamic resolution adjustment mechanism can be introduced to reallocate the corresponding local resolution to each sub-community in the optimal community partitioning result, thereby enabling adaptive optimization of local communities based on the optimal community partitioning result.

[0081] This involves reallocating the corresponding local resolution for each sub-community in the optimal community partitioning result. Specifically, this can include: reallocating the corresponding local resolution for each sub-community in the optimal community partitioning result based on a target formula; the target formula is:

[0082] ;

[0083] For the local resolution allocated to sub-community i, This is an adjustment factor obtained based on the deviation between the internal density of sub-community i and the global average community density. Let be the number of internal nodes of sub-community i, that is, the total number of directed edges established between all nodes in sub-community i. Let be the number of external nodes in sub-community i, that is, the total number of directed edges established between internal nodes and external nodes of sub-community i. It is a tiny constant. This is the time span factor for sub-community i, used to prevent communities that meet the preset high-density criteria from being over-splitting. The alarm time span of sub-community i is the difference between the earliest and latest alarm times among all alarm events in sub-community i.

[0084] in, The definition of is:

[0085] ;

[0086] For the internal density of sub-community i, The global average community density is defined as the density within a community that is significantly higher than the average. Increase resolution This increases accordingly, thereby achieving local subdivision;

[0087] The definition of is:

[0088] ;

[0089] To suppress the scaling factor of the split, , This is the preset minimum time span threshold.

[0090] When the alarm triggering time span is relatively short within a certain community, This leads to the final resolution. This shrinks the community, thereby preventing further fragmentation and maintaining the integrity of the attack chain.

[0091] By combining global multi-scale fusion with local adaptive adjustment, the dynamic resolution Louvain algorithm in this embodiment can achieve stable and interpretable community partitioning at different densities and time scales, thereby extracting a semantically consistent set of attack events from the alarm graph.

[0092] Step S14: Using a preset large language model, identify the core attack nodes in the target community division results based on node attributes and assign confidence to the core attack nodes; the core attack nodes are alarm event nodes that meet the preset attack chain key stage criteria.

[0093] In this embodiment, multiple agents can be used to perform multi-stage, collaborative intelligent analysis on the target community division results determined by the dynamic resolution Louvain algorithm, thereby achieving automated operation analysis; among them, the agent tasks include source tracing analysis, trend prediction, and generation of disposal suggestions.

[0094] It should be noted that, to reduce the computational overhead of complex alarm graphs, decrease token consumption during agent inference, and improve the efficiency of source tracing analysis, the alarm relationship graph corresponding to the target community segmentation results obtained by the dynamic resolution Louvain algorithm can be compressed. Specifically, this can include: identifying groups of target alarm nodes that meet preset fusion conditions from the alarm relationship graph corresponding to the target community segmentation results; the preset fusion conditions are that for any group of target alarm nodes, any group of target alarm nodes corresponds to the same attack source or the same affected asset, is triggered within a preset time window, and the triggering alarm rules are the same. Then, each group of target alarm nodes is merged to obtain the corresponding aggregate node; the attributes of the aggregate node include, but are not limited to, alarm trigger frequency, first alarm trigger timestamp, and last alarm trigger timestamp. For example, when the same attacker repeatedly triggers multiple scan alarms on the same asset within a short period of time, these repeated alarms are merged into one node, and the trigger frequency, time range, etc. are recorded in the node attributes. Next, redundant node attributes of each node in the alarm relationship graph after node merging are removed, and only the core node attributes required for source tracing and trend analysis are retained, such as node identifier, trigger alarm name, attacker identifier, source IP address, destination IP address, alarm risk level, alarm time, alarm count, etc. The data structure of the alarm relationship graph after node attribute removal is converted into a preset index structure to obtain the target alarm relationship graph. The preset index structure includes a node table storing all nodes and an edge table storing all edges in the form of triples. The format of the triples is [source node index, target node index, relationship type].

[0095] Furthermore, the agent takes the compressed alarm relationship graph as input and automatically reconstructs the attack chain by combining time, topology, and alarm attributes. Specific steps may include: using a pre-defined large language model to identify core attack nodes in the target alarm relationship graph based on node attributes and assigning confidence scores to the core attack nodes; the confidence score represents the probability that the corresponding node is a core node.

[0096] For example, the compressed alarm relationship graph can be input into a Large Language Model (LLM). By using predefined prompt words, the LLM can be guided to identify the set of possible core attack nodes based on node attributes. Among them, nodes The attributes include node identifier, confidence level, and attack event type; attack event types include lateral movement, privilege escalation, data leakage, and WebShell requests.

[0097] Step S15: Based on the confidence level and starting from the core attack node, perform a depth-first search on the target community segmentation results to extract a set of paths that are causally related to the core attack node, and use a preset large language model to generate a security event report corresponding to the original network security alarm data based on the set of paths.

[0098] In this embodiment, a depth limit can be set for path search. The depth limit restricts the maximum level of recursive search starting from the search starting point, i.e., controls the maximum number of attack chain levels. Then, core attack nodes are sorted in descending order of confidence. The core attack node with the highest confidence is selected as the current search starting point to perform a depth-first search on the target alarm relationship graph, ensuring that high-value attack chains are discovered first. The search for the current path is terminated when the depth limit is reached or the confidence of subsequent nodes in the path falls below a preset threshold, resulting in the corresponding path set. Next, the next core attack node from the current search starting point is taken as the new current search starting point, and the process jumps to the step of performing a depth-first search on the target alarm relationship graph until the path set corresponding to each core attack node is obtained.

[0099] Furthermore, the attack stages of alert events within the path set can be segmented to obtain the segmentation results. A causal attack chain between the attack source and the affected assets can be constructed, and attack trends can be predicted based on the temporal distribution and behavioral characteristics of the alerts to obtain the prediction results. Then, security handling suggestions can be generated based on the segmentation results, causal attack chains, and prediction results, and a security incident report corresponding to the original network security alert data can be generated based on the security handling suggestions.

[0100] Understandably, the path set, along with a global summary such as the number of nodes, edges, and alarm time range, is input into the LLM. Predefined prompts guide the LLM to perform logical reasoning and semantic understanding analysis based on the temporal relationships, behavioral patterns, risk levels, and node attributes of the paths. During the reasoning process, the LLM can automatically identify the temporal logic and causal relationships of attack behaviors, complete attack phase division (i.e., categorize each alarm time within the path into stages), construct the causal attack chain between the attack source and the affected assets (i.e., analyze the event correlation between the two), derive the complete attack causal path, and perform trend analysis (i.e., predict potential attack trends and future attack types based on temporal distribution and behavioral characteristics), and generate handling suggestions (i.e., output targeted security handling recommendations based on the model's contextual analysis results). Finally, the LLM's output is automatically converted into a structured security incident report.

[0101] As can be seen from the above, and see also Figure 2As shown, this embodiment performs structured modeling on the raw network security alarm data imported from the data access layer, constructs an incremental temporal relationship model to obtain a temporal relationship graph, and stores the temporal relationship graph in a graph database. Combined with the dynamic resolution Louvain community discovery algorithm, it adaptively segments semantically related attack activity sets, thereby extracting a complete set of attack events. Based on this, a multi-agent collaborative analysis mechanism is introduced to perform source tracing analysis, trend prediction, and generate handling suggestions for the community subgraph, ultimately obtaining a security incident report, achieving a complete transformation from raw alarm data to security analysis results. This solution can effectively identify core attack chains and potential threat paths in massive alarm data, mine temporal patterns, automatically generate interpretable security incident reports, and improve the accuracy and generalization ability of source tracing analysis. It achieves automated and interpretable analysis of multi-step attack behaviors, significantly improving the accuracy, interpretability, and operational efficiency of alarm analysis.

[0102] See Figure 3 As shown in the illustration, this application also discloses a network security incident report generation device based on a dynamic resolution community detection algorithm, comprising:

[0103] The information extraction module 11 is used to extract target information from the original network security alarm data as nodes, establish directed edges between nodes according to the chronological order and logical relationship of events, and construct a temporal relationship graph based on the nodes and directed edges; the target information includes alarm events, attack sources and affected assets, and the directed edges include a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected assets;

[0104] The first node partitioning module 12 is used to enumerate multiple resolutions within a preset resolution range, execute a preset community detection algorithm on the temporal relationship graph according to different resolutions, obtain corresponding community partitioning results, determine the normalized mutual information between each community partitioning result, determine the average stability index corresponding to each community partitioning result based on the normalized mutual information between each community partitioning result, and take the community partitioning result with the highest average stability index as the optimal community partitioning result; wherein, the preset community detection algorithm is used to partition semantically related nodes in the temporal relationship graph into the same community, and the average stability index is the average value of the normalized mutual information between any community partitioning result and all other community partitioning results corresponding to the resolution range.

[0105] The second node partitioning module 13 is used to reallocate the corresponding local resolution to each sub-community in the optimal community partitioning result, and execute the preset community discovery algorithm on the corresponding sub-community and adjacent sub-regions according to the local resolution, so as to subdivide or merge the sub-communities in the optimal community partitioning result and obtain the final target community partitioning result.

[0106] Node identification module 14 is used to identify core attack nodes in the target community division result based on node attributes using a preset large language model and assign confidence to the core attack nodes; the core attack nodes are alarm event nodes that meet the preset attack chain key stage criteria.

[0107] The report generation module 15 is used to perform a depth-first search on the target community segmentation results based on the confidence level and starting from the core attack node, to extract a set of paths that are causally related to the core attack node, and to generate a security event report corresponding to the original network security alarm data based on the set of paths using a preset large language model.

[0108] In some specific embodiments, the network security incident report generation device based on the dynamic resolution community detection algorithm further includes:

[0109] The information extraction unit is used to extract target information from the new original network security alarm data as a new node when new original network security alarm data is detected.

[0110] The edge generation unit is used to generate directed edges between the newly added nodes and directed edges between the newly added nodes and nodes in the time sequence graph, based on the chronological order and logical relationship of the events and the existing temporal relationship graph.

[0111] The graph update unit is used to add the newly added nodes and the generated directed edges to the temporal relationship graph.

[0112] In some specific embodiments, the second node partitioning module 13 includes:

[0113] A resolution allocation unit is used to reallocate the corresponding local resolution to each sub-community in the optimal community partitioning result based on a target formula; the target formula is:

[0114] ;

[0115] For the local resolution allocated to sub-community i, This is an adjustment factor obtained based on the deviation between the internal density of sub-community i and the global average community density. Let be the number of internal nodes of sub-community i, that is, the total number of directed edges established between all nodes in sub-community i. Let be the number of external nodes in sub-community i, that is, the total number of directed edges established between internal nodes and external nodes of sub-community i. It is a tiny constant. This is the time span factor for sub-community i, used to prevent communities that meet the preset high-density criteria from being over-splitting. The alarm time span of sub-community i is the difference between the earliest and latest alarm times among all alarm events in sub-community i.

[0116] in, The definition of is:

[0117] ;

[0118] For the internal density of sub-community i, The global average community density;

[0119] The definition of is:

[0120] ;

[0121] To suppress the scaling factor of the split, This is the preset minimum time span threshold.

[0122] In some specific embodiments, the node identification module 14 further includes:

[0123] The first node identification unit is used to identify each group of target alarm nodes that meet the preset fusion conditions from the alarm relationship graph corresponding to the target community division result; the preset fusion conditions are that for any group of target alarm nodes, the target alarm nodes correspond to the same attack source or the same affected asset, are triggered within a preset time window, and the alarm rules triggered are the same.

[0124] The node merging unit is used to merge the target alarm nodes of each group to obtain the corresponding aggregate node; the attributes of the aggregate node include alarm trigger frequency, first alarm trigger timestamp and last alarm trigger timestamp;

[0125] The structure conversion unit is used to remove redundant node attributes of each node in the alarm relationship graph after node merging, and convert the data structure of the alarm relationship graph after node attribute removal into a preset index structure to obtain the target alarm relationship graph. The preset index structure includes a node table storing all nodes and an edge table storing all edges in the form of triples. The format of the triples is [source node index, target node index, relationship type].

[0126] In some specific embodiments, the node identification module 14 includes:

[0127] The second node identification unit is used to identify the core attack node in the target alarm relationship graph based on the node attributes using a preset large language model and assign a confidence level to the core attack node; the confidence level represents the probability that the corresponding node is a core attack node.

[0128] In some specific embodiments, the report generation module 15 includes:

[0129] The depth limit setting unit is used to set the depth limit of the path search; the depth limit is used to limit the maximum level of the recursive search starting from the search starting point;

[0130] The search unit is used to sort the core attack nodes in descending order of confidence, select the core attack node with the highest confidence as the current search starting point to perform a depth-first search on the target alarm relationship graph, and terminate the search of the current path when the upper limit of the depth is reached or the confidence of the subsequent nodes in the path is lower than a preset threshold, thereby obtaining the corresponding path set.

[0131] The path set acquisition unit is used to take the next core attack node of the current search starting point as the new current search starting point, and jump to the step of performing a depth-first search on the target alarm relationship graph until the path sets corresponding to all core attack nodes are obtained.

[0132] In some specific embodiments, the report generation module 15 includes:

[0133] The prediction unit is used to divide the alarm events in the path set into attack stages, obtain the division results, construct the causal attack chain between the attack source and the affected assets, and predict the attack trend based on the temporal distribution and behavioral characteristics of the alarms to obtain the prediction results.

[0134] The report generation unit is used to generate security handling suggestions based on the segmentation results, the causal attack chain, and the prediction results, and to generate a security incident report corresponding to the original network security alarm data based on the security handling suggestions.

[0135] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0136] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network security incident report generation method based on the dynamic resolution community detection algorithm disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.

[0137] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0138] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0139] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the network security incident report generation method based on the dynamic resolution community detection algorithm disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0140] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned network security incident report generation method based on a dynamic resolution community detection algorithm. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0141] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0142] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0143] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0144] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0145] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for generating network security incident reports based on a dynamic resolution community detection algorithm, characterized in that, include: Target information is extracted from the original network security alarm data as nodes. Directed edges are established between nodes according to the chronological order and logical relationship of events. A temporal relationship graph is constructed based on the nodes and directed edges. The target information includes alarm events, attack sources, and affected assets. The directed edges include a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected assets. Multiple resolutions are enumerated within a preset resolution range. A preset community detection algorithm is executed on the temporal relationship graph according to different resolutions to obtain corresponding community partitioning results. The normalized mutual information between each community partitioning result is determined. Based on the normalized mutual information between each community partitioning result, the average stability index corresponding to each community partitioning result is determined. The community partitioning result with the highest average stability index is taken as the optimal community partitioning result. The preset community detection algorithm is used to partition semantically related nodes in the temporal relationship graph into the same community. The average stability index is the average value of the normalized mutual information between any community partitioning result and all other community partitioning results corresponding to the resolution range. The corresponding local resolution is reallocated to each sub-community in the optimal community division result. The preset community discovery algorithm is executed on the corresponding sub-community and adjacent sub-regions according to the local resolution to achieve the subdivision or merging of the sub-communities in the optimal community division result, so as to obtain the final target community division result. Using a pre-defined large language model, the core attack nodes in the target community segmentation results are identified based on node attributes, and confidence is assigned to the core attack nodes; the core attack nodes are alarm event nodes that meet the pre-defined critical stage criteria of the attack chain. Based on the confidence level, and starting from the core attack node, a depth-first search is performed on the target community segmentation results to extract a set of paths that are causally related to the core attack node. A security event report corresponding to the original network security alarm data is generated based on the path set using a preset large language model.

2. The method for generating network security incident reports based on a dynamic resolution community detection algorithm according to claim 1, characterized in that, Also includes: When new raw network security alarm data is detected, the target information in the new raw network security alarm data is extracted as a new node; Based on the chronological order and logical relationship of events, as well as the existing temporal relationship graph, directed edges are generated between the newly added nodes and between the newly added nodes and nodes in the temporal relationship graph. The newly added nodes and the generated directed edges are added to the temporal relationship graph.

3. The method for generating network security incident reports based on a dynamic resolution community detection algorithm according to claim 1, characterized in that, The process of reallocating the corresponding local resolution to each sub-community in the optimal community partitioning result includes: Based on the objective formula, the corresponding local resolution is reallocated to each sub-community in the optimal community partitioning result; the objective formula is: ； For the local resolution allocated to sub-community i, This is an adjustment factor obtained based on the deviation between the internal density of sub-community i and the global average community density. Let be the number of internal nodes of sub-community i, that is, the total number of directed edges established between all nodes in sub-community i. Let be the number of external nodes in sub-community i, that is, the total number of directed edges established between internal nodes and external nodes of sub-community i. It is a tiny constant. This is the time span factor for sub-community i, used to prevent communities that meet the preset high-density criteria from being over-splitting. The alarm time span of sub-community i is the difference between the earliest and latest alarm times among all alarm events in sub-community i. in, The definition of is: ； For the internal density of sub-community i, The global average community density; The definition of is: ； To suppress the scaling factor of the split, This is the preset minimum time span threshold.

4. The method for generating network security incident reports based on the dynamic resolution community detection algorithm according to claim 1, characterized in that, Before identifying the core attack nodes in the target community partitioning results using a preset large language model based on node attributes, the process also includes: Identify each group of target alarm nodes that meet the preset fusion conditions from the alarm relationship graph corresponding to the target community division results; the preset fusion conditions are that for any group of target alarm nodes, the target alarm nodes correspond to the same attack source or the same affected asset, are triggered within a preset time window, and the alarm rules triggered are the same. Each group of target alarm nodes is merged to obtain a corresponding aggregate node; the attributes of the aggregate node include alarm trigger frequency, first alarm trigger timestamp, and last alarm trigger timestamp; Redundant node attributes of each node in the alarm relationship graph after node merging are removed. The data structure of the alarm relationship graph after node attribute removal is converted into a preset index structure to obtain the target alarm relationship graph. The preset index structure includes a node table storing all nodes and an edge table storing all edges in the form of triples. The format of the triples is [source node index, target node index, relationship type].

5. The method for generating network security incident reports based on the dynamic resolution community detection algorithm according to claim 4, characterized in that, The step of using a pre-defined large language model to identify core attack nodes in the target community partitioning results based on node attributes and assigning confidence scores to the core attack nodes includes: Using a pre-defined large language model, the core attack nodes in the target alarm relationship graph are identified based on node attributes, and a confidence level is assigned to the core attack nodes; the confidence level represents the probability that the corresponding node is a core attack node.

6. The method for generating network security incident reports based on the dynamic resolution community detection algorithm according to claim 5, characterized in that, The step of performing a depth-first search on the target community segmentation results based on the confidence level and starting from the core attack node to extract a set of paths causally related to the core attack node includes: Set an upper limit on the depth of the path search; the upper limit on the depth is used to limit the maximum level of the recursive search starting from the search starting point; The core attack nodes are sorted in descending order of confidence. The core attack node with the highest confidence is selected as the current search starting point to perform a depth-first search on the target alarm relationship graph. The search of the current path is terminated when the upper limit of the depth is reached or the confidence of the subsequent nodes in the path is lower than a preset threshold, and the corresponding path set is obtained. The next core attack node from the current search starting point is taken as the new current search starting point, and the process jumps to the step of performing a depth-first search on the target alarm relationship graph until the path set corresponding to each core attack node is obtained.

7. The method for generating network security incident reports based on a dynamic resolution community detection algorithm according to claim 1, characterized in that, The generation of the security event report corresponding to the original network security alert data based on the path set includes: The alarm events within the path set are divided into attack stages to obtain the division results. A causal attack chain between the attack source and the affected assets is constructed. The attack trend is predicted based on the temporal distribution and behavioral characteristics of the alarms to obtain the prediction results. Based on the segmentation results, the causal attack chain, and the prediction results, security handling suggestions are generated, and based on the security handling suggestions, a security incident report corresponding to the original network security alarm data is generated.

8. A network security incident report generation device based on a dynamic resolution community detection algorithm, characterized in that, include: The information extraction module is used to extract target information from the original network security alarm data as nodes, establish directed edges between nodes according to the order of events and logical relationships, and construct a temporal relationship graph based on nodes and directed edges. The target information includes alarm events, attack sources, and affected assets. The directed edges include a first directed edge representing the temporal relationship between alarm events, a second directed edge representing the triggering relationship between the attack source and the triggered alarm event, and a third directed edge representing the target relationship between the alarm event and the affected asset. The first node partitioning module is used to enumerate multiple resolutions within a preset resolution range, execute a preset community detection algorithm on the temporal relationship graph according to different resolutions, obtain corresponding community partitioning results, determine the normalized mutual information between each community partitioning result, determine the average stability index corresponding to each community partitioning result based on the normalized mutual information between each community partitioning result, and take the community partitioning result with the highest average stability index as the optimal community partitioning result; wherein, the preset community detection algorithm is used to partition semantically related nodes in the temporal relationship graph into the same community, and the average stability index is the average value of the normalized mutual information between any community partitioning result and all other community partitioning results corresponding to the resolution range; The second node partitioning module is used to reallocate the corresponding local resolution to each sub-community in the optimal community partitioning result, and execute the preset community discovery algorithm on the corresponding sub-community and adjacent sub-regions according to the local resolution, so as to subdivide or merge the sub-communities in the optimal community partitioning result and obtain the final target community partitioning result. The node identification module is used to identify the core attack nodes in the target community division results based on node attributes using a preset large language model and assign confidence to the core attack nodes; the core attack nodes are alarm event nodes that meet the preset attack chain key stage criteria. The report generation module is used to perform a depth-first search on the target community segmentation results based on the confidence level and starting from the core attack node, to extract a set of paths that are causally related to the core attack node, and to generate a security event report corresponding to the original network security alarm data based on the set of paths using a preset large language model.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the network security incident report generation method based on the dynamic resolution community discovery algorithm as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the network security incident report generation method based on the dynamic resolution community detection algorithm as described in any one of claims 1 to 7.

Images